Computer viruses, worms, trojans, hackers, malicious executables, probes, etc. can be a menace to users of digital processing devices connected to public computer networks (such as the Internet) and/or private networks (such as corporate computer networks). In response to these threats, various networks employ protective measures, such as, antivirus software, logging, firewalls, honeypots, roll-back/recovery, and/or intrusion detection systems, etc. However, these protective measures are not always adequate.
Security policies (e.g., policies developed by a system administrator for responding to attacks) can provide guidance for various protective measures. However, typical mechanically-enforced security policies can be limited to traditional admission-based access control and policy enforcement can be limited to allow/deny semantics that can be insufficient in providing the desired protection. This can, for example, be because the focus of the protection is on protecting a specific component in response to a specific attack on that component without also enacting network wide protection. For example, locking the username/password of a user who has repeatedly provided the wrong password does not, for example, prevent that user from attempting to access portions of a system not secured by that username/password. Access-control mechanisms that operate independently on each service can lead to inconsistent or incorrect application of an intended system-wide policy.
Accordingly, it is desirable to provide systems, methods, and media that overcome these and other deficiencies of the prior art.